Technical impact
The vulnerability arises when the Wagtail Pages admin API returns page fields defined in api_fields without applying the correct access checks. This allows any authenticated user with admin rights to read restricted draft and live page content, exposing data that should otherwise be protected. The flaw is an information‑disclosure issue, potentially revealing sensitive page metadata and content to privileged users.
Affected Systems
All installations of Wagtail up to, but not including, version 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 are vulnerable. The problem is confined to the Pages admin API and does not affect other parts of the CMS. Deployments that use Wagtail admin access are at risk.
Risk and Exploitability
The CVSS score of 4.3 indicates moderate severity; no EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. An attacker must first obtain legitimate admin credentials or have access to a user account that already possesses admin rights. Once authenticated, the attacker can call the admin API and retrieve confidential page data, but the flaw does not provide remote code execution or privilege escalation beyond the administrative scope.
Github GHSA